Vertically extensible intrusion detection system and method

Abstract

A method for vertically extensible intrusion detection for an enterprise comprises receiving a first packet flow from a first node, the first packet flow comprising at least a portion of packet headers received at the first node during a first timeframe and receiving a second packet flow, the second packet flow comprising at least a portion of packet headers received at the second node during a second timeframe. The first and second packet flow are processed to detect an attack on the enterprise system. In response to the attack, an alert message is communicated to a master server, a response message is received from the master server, the response message comprising a signature to impede the attack, and the response message is automatically communicated to the first node and the second node.

1. Software encoded in one or more computer-readable storage media and when executed operable to:
 receive a first packet flow from a first node, the first packet flow comprising at least a portion of packet headers received at the first node during a first timeframe; 
 receive a second packet flow from a second node, the second packet flow comprising at least a portion of packet headers received at the second node during a second timeframe; 
 process the first and second packet flows to detect an attack; 
 associate the first packet flow with the second packet flow to create a third packet flow, the third packet flow comprising the first and second packet flows; 
 associate an alert message with the third packet flow; 
 in response to the attack:
 communicate the alert message to a master server, wherein the operability of the software to communicate the alert message to the master server comprises the software being operable to communicate the third packet flow and the associated alert message to the master server; 
 receive a response message from the master server; 
 automatically communicate the response message to the first node; 
 automatically communicate the response message to the second node; 
 
 wherein the response message is operable to impede, at the first node and the second node, the attack; and 
 wherein the first packet flow received from the first node is associated with a first priority and the second packet flow received from the second node is associated with a second priority, the software further operable to: 
 compare the first priority and the second priority; 
 in response to the first priority not being less than the second priority, assign the first priority to the third packet flow; and 
 in response to the second priority being greater than the first priority, assign the second priority to the third packet flow. 
 
     
     
       2. The software of  claim 1  further operable to:
 compute a priority of the third packet flow based, at least in part, on the alert message and on one or more rules; and 
 assign the computed priority to the third packet flow. 
 
     
     
       3. The software of  claim 2 , wherein the operability of the software to communicate the third packet flow and the associated alert message to the master server comprises the software being operable to communicate the third packet flow and the associated alert message to the master server based on the priority. 
     
     
       4. The software of  claim 1 , the first timeframe comprising time between a Transmission Control Protocol (TCP) handshake and a TCP reset/timeout. 
     
     
       5. The software of  claim 1  further operable to: compute a verification value for the alert message; and
 associate the verification value with the alert message to be communicated to the master server. 
 
     
     
       6. The software of  claim 1 , wherein the operability of the software to receive a response message from the master server comprises the software being operable to:
 receive the response message associated with a first verification value; 
 compute a second verification value based on the response message; 
 compare the first and second verification values; and 
 in response to the first and second verification values not being equal, not communicate the response message to the first node or the second node. 
 
     
     
       7. The software of  claim 1 , wherein the master server comprises a global server, the first node comprises a first manager server and the second node comprises a second manager server. 
     
     
       8. The intrusion detection software of  claim 7 , wherein the global server comprises a global correlation engine and an archive database, the global correlation engine operable to automatically process the archive database to detect a long-term attack. 
     
     
       9. The software of  claim 1  further operable to:
 receive first archival data from the first node, the first archival data comprising the full packet information associated with the first message; and 
 receive second archival data from the second node, the second archival data comprising substantially all of the packet information associated with the second message. 
 
     
     
       10. The software of  claim 9  further operable to:
 combine the first and second archival data into third archival data; and 
 communicate the third archival data to the master server. 
 
     
     
       11. The software of  claim 1 , wherein the software is operable to process the first and second packet flows at a speed substantially similar to a maximum processing speed between the first node and the second node. 
     
     
       12. A method comprising:
 receiving a first packet flow from a first node, the first packet flow comprising at least a portion of packet headers received at the first node during a first timeframe; 
 receiving a second packet flow from a second node, the second packet flow comprising at least a portion of packet headers received at the second node during a second timeframe; 
 processing the first and second packet flows to detect an attack on an enterprise system; 
 associating the first packet flow with the second packet flow to create a third packet flow, the third packet flow comprising the first and second packet flows; 
 associating an alert message with the third Packet flow; 
 in response to the attack:
 communicating the alert message to a master server, wherein the step of communicating the alert message to the master server comprises communicating the third packet flow and the associated alert message to the master server; 
 receiving a response message from the master server; 
 automatically communicating the response message to the first node; 
 automatically communicating the response message to the second node; 
 
 wherein the response message is operable to impede, at the first node and the second node, the attack; and 
 wherein the first packet flow received from the first node is associated with a first priority and the second packet flow received from the second node is associated with a second priority, the method further comprising: 
 comparing the first priority and the second priority; 
 in response to the first priority not being less than the second priority, assigning the first priority to the third packet flow; and 
 in response to the second priority being greater than the first priority, assigning the second priority to the third packet flow. 
 
     
     
       13. The method of  claim 12  further comprising:
 computing a priority of the third packet flow based, at least in part, on the alert message and on one or more rules; and 
 assigning the computed priority to the third packet flow. 
 
     
     
       14. The method of  claim 13  further comprising communicating the third message and the associated alert message to the master server based on the priority. 
     
     
       15. The method of  claim 12 , the first timeframe comprising time between a Transmission Control Protocol (TCP) handshake and a TCP reset/timeout. 
     
     
       16. The method of  claim 12  further comprising:
 computing a verification value for the alert message; and 
 associating the verification value with the alert message to be communicated to the master server. 
 
     
     
       17. The method of  claim 12 , further comprising:
 receiving the response message associated with a first verification value; 
 computing a second verification value based on the response message; 
 comparing the first and second verification values; and 
 in response to the first and second verification values not being equal, not communicating the response message to the first node or the second node. 
 
     
     
       18. The method of  claim 12 , wherein the master server comprises a global server, the first node comprises a first manager server and the second node comprises a second manager server. 
     
     
       19. The method of  claim 18 , wherein the global server comprises a global correlation engine and an archive database, the global correlation engine operable to automatically process the archive database to detect a long-term attack. 
     
     
       20. The method of  claim 12  further comprising:
 receiving first archival data from the first node, the first archival data comprising the full packet data associated with the first message; and 
 receiving second archival data from the second node, the second archival data comprising substantially all of the packet data associated with the second message. 
 
     
     
       21. The method of  claim 20  further comprising:
 combining the first and second archival data into third archival data; and 
 communicating the third archival data to the master server. 
 
     
     
       22. The method of  claim 12 , wherein the first and second messages are processed at a speed substantially similar to a maximum processing speed between the first node and the second node. 
     
     
       23. Logic encoded in one or more tangible storage media for execution and when executed operable to:
 receive a first message from a first node; 
 receive a second message from a second node; 
 process the first and second packet messages to detect an attack on an enterprise system; 
 associate the first message with the second message to create a third message, the third message comprising the first and second messages; 
 associate an alert message with the third message; 
 in response to the attack:
 communicate the alert message to a master server, wherein the operability of the logic to communicate the alert message to the master server comprises the logic being operable to communicate the third message and the associated alert message to the master server; 
 receive a response message from the master server; 
 automatically communicate the response message to the first node; 
 automatically communicate the response message to the second node; 
 
 wherein the response message is operable to impede, at the first node and the second node, the attack; and 
 wherein the first message received from the first node is associated with a first priority and the second message received from the second node is associated with a second priority, the logic further operable to: 
 compare the first priority and the second priority; 
 in response to the first priority not being less than the second priority, assign the first priority to the third message; and in response to the second priority being greater than the first priority, assign the second priority to the third message. 
 
     
     
       24. The logic of  claim 23  further operable to:
 compute a priority of the third message based, at least in part, on the alert message and on one or more rules; and 
 assign the computed priority to the third message. 
 
     
     
       25. The logic of  claim 24 , wherein the operability of the logic to communicate the third message and the associated alert message to the master server comprises the intrusion detection software being operable to communicate the third message and the associated alert message to the master server based on the priority. 
     
     
       26. The logic of  claim 23  further operable to:
 compute a verification value for the alert message; and 
 associate the verification value with the alert message to be communicated to the master server. 
 
     
     
       27. The logic of  claim 23 , wherein the operability of the logic to receive a response message from the master server comprises the logic being operable to:
 receive the response message associated with a first verification value; 
 compute a second verification value based on the response message; 
 compare the first and second verification values; and 
 in response to the first and second verification values not being equal, not communicate the response message to the first node or the second node. 
 
     
     
       28. The logic of  claim 23 , wherein the master server comprises a global server, the first node comprises a first manager server and the second node comprises a second manger server. 
     
     
       29. The logic of  claim 28 , wherein the global server comprises a global correlation engine and an archive database, the global correlation engine operable to automatically process the archive database to detect a long-term attack. 
     
     
       30. The logic of  claim 23  further operable to:
 receive first archival data from the first node, the first archival data comprising the full Internet Protocol (IP) data associated with the first message; and 
 receive second archival data from the second node, the second archival data comprising substantially all of the IP data associated with the second message. 
 
     
     
       31. The logic of  claim 30  further operable to:
 combine the first and second archival data into third archival data; and 
 communicate the third archival data to the master server. 
 
     
     
       32. The logic of  claim 23 , wherein the logic is operable to process the first and second messages at a speed substantially similar to a maximum processing speed between the first node and the second node. 
     
     
       33. A system comprising:
 a first sensor operable to receive data from a first port on a network; 
 a second sensor operable to receive data from a second port on the network; and 
 a manager server communicably connected to the first and second sensors, the manager server operable to:
 retrieve a first message from the first sensor, the first message comprising binary data for a first timeframe; 
 retrieve a second message from the second sensor, the second message comprising binary data for a second timeframe; 
 communicate the first and second messages to a master server, the master server communicably connected to the manager server; 
 process the first and second messages to detect an attack on an enterprise system; 
 associate the first message with the second message to create a third message, the third message comprising the first and second messages; 
 associate an alert message with the third message; 
 
 in response to the attack, the manager server further operable to
 communicate the alert message to the master server, wherein the operability of the manager server to communicate the alert message to the master server comprises the manager server being operable to communicate the third message and the associated alert message to the master server, 
 receive a response message from the master server, 
 automatically communicate the response message to the first sensor, and 
 automatically communicate the response message to the second sensor, 
 
 wherein the first sensor and the second sensor are operable to impede the attack based on the automatically communicated response messages; and 
 wherein the first message received from the first sensor is associated with a first priority and the second message received from the second sensor is associated with a second priority, the manager server further operable to: 
 compare the first priority and the second priority; 
 in response to the first priority not being less than the second priority, assign the first priority to the third message; and 
 in response to the second priority being greater than the first priority, assign the second priority to the third message. 
 
     
     
       34. The system of  claim 33 , the manager server further operable to:
 compute a priority of the third message based, at least in part, on the alert message and on one or more rules; and 
 assign the computed priority to the third message. 
 
     
     
       35. The system of  claim 34 , the manager server further operable to communicate the third message and the associated alert message to the master server based on the priority. 
     
     
       36. The system of  claim 33 , the first timeframe comprising time between a Transmission Control Protocol (TCP) handshake and a TCP reset/timeout. 
     
     
       37. The system of  claim 33 , the manager server further operable to:
 compute a verification value for the alert message; and 
 associate the verification value with the alert message to be communicated to the master server. 
 
     
     
       38. The system of  claim 33 , the manager server further operable to:
 receive the response message associated with a first verification value; 
 compute a second verification value based on the response message; 
 compare the first and second verification values; and 
 in response to the first and second verification values not being equal, to communicate the response message to the first node or the second node. 
 
     
     
       39. The system of  claim 33 , wherein the manager server comprises a first manager server and the master server comprises a first master server, the system further comprising:
 a second master server, the second master server communicably connected to at least one second manager server, the second manager server communicably connected to at least a third and fourth sensor; 
 a global server, the global server communicably connected to the first and second master server and operable to:
 receive a third message from the first master server, the third message comprising a first plurality of messages and a first priority; 
 receive a fourth message from the second master server, the fourth message comprising a second plurality of messages and a second priority; and 
 process the third and fourth messages to detect a system-wide attack. 
 
 
     
     
       40. The system of  claim 39  further comprising an archive database, the global server further operable to:
 receive first archival data from the first master server, the first archival data comprising the full IP data associated with the first message; 
 receive second archival data from the second master server, the second archival data comprising substantially all of the IP data associated with the second message; 
 store the first and second archival data in the archive database; and 
 automatically process the archive database to detect a long-term attack. 
 
     
     
       41. The system of  claim 39  further comprising an operator console communicably connected to the global server via secure socket layer technology, the operator console operable to communicate static response messages to the global server. 
     
     
       42. The system of  claim 41 , the global server further operable to automatically communicate the static response messages to the first and second master server based, at least in part, on a distribution ruleset. 
     
     
       43. The system of  claim 33  further comprising a slave server operable to automatically substantially assume the responsibilities of the manager server in the event of a failure of the manager server. 
     
     
       44. The system of  claim 33  further comprising:
 a first slave sensor operable to automatically assume substantially all of the functionality of the first sensor in the event of a failure of the first sensor; and 
 a second slave sensor operable to automatically assume substantially all of the functionality of the second sensor in the event of a failure of the second sensor. 
 
     
     
       45. The system of  claim 33 , wherein the manager server is operable to process the first and second messages at a speed substantially similar to a maximum processing speed between the first sensor and the second sensor.